SOA-C02 Practice Test 42 — 15 Questions

Question 1

A company uses AWS Elastic Beanstalk to deploy a web application. The environment is running a single instance. The SysOps administrator needs to update the application to a new version with zero downtime. What should the administrator do?

Accepted Answer

Perform an immutable update in the Elastic Beanstalk environment.. Option A is correct because an immutable update launches a new instance with the new version and then swaps the old instance, ensuring zero downtime. Option B is wrong because rolling updates on a single instance still cause a brief downtime. Option C is wrong because Blue/Green deployment requires two environments. Option D is wrong because the RDS instance is separate; swapping it does not update the application.

Answer

Perform a rolling update with a batch size of 1.

Answer

Perform a Blue/Green deployment by swapping environment URLs.

Answer

Update the application version and swap the RDS database.

Question 2

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack creation. The stack includes an AWS::Lambda::Function resource. The error message states: 'The runtime parameter of nodejs8.10 is no longer supported.' The administrator needs to resolve this with minimal changes. What should the administrator do?

Accepted Answer

Update the CloudFormation template to use a supported Node.js runtime, such as nodejs14.x.. Option B is correct because the error indicates the runtime is deprecated; updating the runtime to a supported version (e.g., nodejs14.x) resolves the issue. Option A is wrong because the Lambda function code is likely compatible with a newer runtime. Option C is wrong because the runtime is specified in the CloudFormation template, not in the Lambda console. Option D is wrong because waiting will not fix the deprecated runtime.

Answer

Modify the Lambda function code to use Python 3.8.

Answer

Manually update the runtime in the AWS Lambda console after the stack creation fails.

Answer

Wait for AWS to re-enable the nodejs8.10 runtime.

Question 3

A SysOps administrator is provisioning an Auto Scaling group (ASG) for a stateless web application. The ASG should launch EC2 instances in multiple Availability Zones. The administrator needs to ensure that instances are evenly distributed across Availability Zones. Which configuration should the administrator use?

Accepted Answer

Create subnets in multiple Availability Zones and specify them in the Auto Scaling group.. Option C is correct because setting the Auto Scaling group to use multiple subnets in different Availability Zones and the 'balanced best effort' distribution policy ensures even distribution. Option A is wrong because a single subnet limits to one AZ. Option B is wrong because same-AZ subnets don't provide multi-AZ. Option D is wrong because 'availability-zone' health check is not a distribution policy.

Answer

Use an 'availability-zone' health check type in the Auto Scaling group.

Answer

Create the Auto Scaling group with a single subnet in one Availability Zone.

Answer

Create subnets in multiple Availability Zones but assign them to the same placement group.

Question 4

A company wants to allow its DevOps team to launch EC2 instances using a specific AMI ID and only in a particular VPC. Which IAM policy should be used?

Accepted Answer

{"Effect":"Allow","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringEquals":{"ec2:Vpc":"vpc-12345678","ec2:ImageId":"ami-12345678"}}}. Option D is correct because it uses condition keys ec2:Vpc and ec2:ImageId to restrict the RunInstances action to the specified VPC and AMI. Option A is wrong because it only restricts the VPC but not the AMI. Option B is wrong because it restricts the AMI but not the VPC. Option C is wrong because it uses a deny statement that would block all instances not matching both conditions, which may be too restrictive for other allowed actions.

Answer

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringNotEquals":{"ec2:Vpc":"vpc-12345678"},"StringNotEquals":{"ec2:ImageId":"ami-12345678"}}}

Answer

{"Effect":"Allow","Action":"ec2:RunInstances","Resource":"arn:aws:ec2:region::image/ami-12345678"}

Answer

{"Effect":"Allow","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringEquals":{"ec2:Vpc":"vpc-12345678"}}}

Question 5

A SysOps administrator needs to automate the provisioning of AWS resources using infrastructure as code. The solution must track changes and allow rollbacks. Which AWS service should the administrator use?

Accepted Answer

AWS CloudFormation. Option B is correct because AWS CloudFormation provides infrastructure as code with change tracking and rollback capabilities. Option A is wrong because AWS Config is for compliance and auditing, not provisioning. Option C is wrong because AWS OpsWorks is a configuration management service, not primarily IaC. Option D is wrong because AWS Service Catalog is for managing approved products, not general IaC.

Answer

AWS Config

Answer

AWS Service Catalog

Answer

AWS OpsWorks

Question 6

A DevOps engineer is designing a CI/CD pipeline for a microservices application. The application consists of several Docker containers that run on Amazon ECS with Fargate launch type. The engineer wants to automate the deployment of new container versions. Which AWS service should be used to orchestrate the build, test, and deployment stages?

Accepted Answer

AWS CodePipeline. Option B is correct because AWS CodePipeline is a fully managed continuous delivery service that helps automate the build, test, and deploy phases of the release process. Option A is wrong because AWS CodeBuild is for building and testing code, not for orchestrating the entire pipeline. Option C is wrong because AWS CodeDeploy is for deploying applications to compute services but does not orchestrate the entire pipeline. Option D is wrong because AWS CloudFormation is for infrastructure as code, not CI/CD orchestration.

Answer

AWS CodeDeploy

Answer

AWS CloudFormation

Answer

AWS CodeBuild

Question 7

A SysOps administrator is deploying a CloudFormation stack that includes an AWS::ECS::Service resource. The service uses a task definition that references a container image stored in Amazon ECR. The stack creation fails with the error: 'Unable to assume the service-linked role.' What is the MOST likely cause?

Accepted Answer

The ECS service-linked role does not exist in the account.. Option B is correct because ECS requires a service-linked role (AWSServiceRoleForECS) to manage resources, and if it does not exist, CloudFormation will fail. Option A is wrong because the task execution role is separate from the service-linked role. Option C is wrong because ECR permissions are for pulling images, not for the service role. Option D is wrong because CloudFormation uses its own role, not the service-linked role.

Answer

The task execution role does not have permissions to pull the container image from ECR.

Answer

The CloudFormation service role does not have permission to create ECS resources.

Answer

The ECR repository policy does not grant access to the ECS service.

Question 8

A SysOps Administrator needs to automate the deployment of a three-tier web application on AWS. The application consists of a web tier, application tier, and database tier. The administrator wants to use AWS CloudFormation to provision the infrastructure. Which TWO resources should be included in the CloudFormation template to ensure the application is highly available across multiple Availability Zones?

Accepted Answer

Auto Scaling group. Option A and Option D are correct. An Auto Scaling group is used to maintain a desired number of instances across AZs, and an Application Load Balancer distributes traffic across those instances. Option B (NAT Gateway) is for outbound internet access, not high availability. Option C (S3 bucket) is for storage, not compute. Option E (Route 53 hosted zone) is for DNS, not directly for high availability of the application tiers.

Answer

NAT Gateway

Answer

Amazon S3 bucket

Answer

Amazon Route 53 hosted zone

Question 9

A SysOps administrator is designing a deployment pipeline using AWS CodePipeline. The pipeline must deploy a serverless application using AWS SAM. The administrator wants to run integration tests after the deployment. Which THREE services should be used together? (Choose THREE.)

Accepted Answer

AWS CodePipeline. Option A is correct because CodePipeline orchestrates the pipeline. Option B is correct because AWS SAM is used to deploy serverless applications. Option C is correct because CodeBuild can run integration tests as part of the pipeline. Option D is wrong because CodeDeploy is for EC2/Lambda, but SAM is more appropriate for serverless. Option E is wrong because CodeCommit is a source repository, not for testing.

Answer

AWS CodeCommit

Answer

AWS CodeDeploy

Question 10

A SysOps Administrator attached the IAM policy shown in the exhibit to a user. The user is unable to terminate an EC2 instance. What is the MOST likely reason?

Accepted Answer

An explicit Deny statement overrides the Allow statement.. Option C is correct. The Deny statement explicitly denies the ec2:TerminateInstances action, and an explicit Deny overrides any Allow. Option A is wrong because the policy allows ec2:* but the Deny takes precedence. Option B is wrong because ec2:* includes all ec2 actions. Option D is wrong because the policy allows all ec2 actions; the Deny is the cause.

Answer

The policy does not include ec2:TerminateInstances in the Allow statement.

Answer

The policy does not specify the correct resource ARN.

Answer

The policy does not allow ec2:* actions.

Question 11

A SysOps Administrator attempted to update a CloudFormation stack. The stack update failed and is now in UPDATE_ROLLBACK_IN_PROGRESS state as shown in the exhibit. What should the administrator do to recover the stack to a stable state?

Accepted Answer

Wait for the rollback to complete and then investigate the failure reason.. Option D is correct. Since the stack is in rollback, waiting for the rollback to complete is the appropriate action. The stack will attempt to roll back to the previous state. Option A is wrong because deleting the stack is not necessary; the rollback will restore the previous state. Option B is wrong because continuing the update would fail. Option C is wrong because executing a change set would require the stack to be in a stable state.

Answer

Delete the stack and recreate it.

Answer

Manually update the Auto Scaling group to correct the issue.

Answer

Execute a change set to fix the failed resource.

Question 12

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon EC2 instance and an associated security group. The stack creation fails with the error: 'Resource creation cancelled' after the security group is created but before the instance is launched. What is the MOST likely cause?

Accepted Answer

The EC2 instance resource configuration has an error.. Option D is correct because CloudFormation typically creates resources in parallel, but if one resource fails, it cancels others. The error indicates a dependency issue or a misconfiguration in the instance resource. Option A is wrong because the security group was created successfully. Option B is wrong because the stack was not deleted. Option C is wrong because AWS CloudFormation does not require a rollback trigger for a failed resource creation; it automatically rolls back.

Answer

The security group failed to create.

Answer

The stack was manually deleted during creation.

Answer

The stack's rollback trigger was not configured.

Question 13

A company uses AWS OpsWorks to manage a stack of EC2 instances running a web application. They recently migrated to AWS Elastic Beanstalk for easier deployments. However, after the migration, some users report that the application is responding slowly during peak hours. The Elastic Beanstalk environment is configured with a load balancer and auto scaling based on average CPU utilization. What should the SysOps Administrator do to troubleshoot the performance issue?

Accepted Answer

Review the CloudWatch metrics and logs for the Elastic Beanstalk environment.. Option C is correct because reviewing CloudWatch metrics and logs from the Elastic Beanstalk environment can identify if the auto scaling policy is not aggressive enough or if there are other bottlenecks. Option A is wrong because OpsWorks is no longer used. Option B is wrong because switching to manual scaling is not a best practice. Option D is wrong because increasing instance size without analysis may be inefficient.

Answer

Manually scale the environment to add more instances.

Answer

Revert to the OpsWorks stack configuration.

Answer

Increase the instance size in the environment configuration.

Question 14

A company is using AWS CodeDeploy to deploy a new version of an application to a fleet of EC2 instances. The deployment is configured with a Blue/Green deployment type. During the deployment, the new instances pass all health checks, but the old instances are not being terminated automatically. The SysOps Administrator needs to ensure that the old instances are terminated after a successful deployment. Which TWO actions should the administrator take? (Choose TWO.)

Accepted Answer

Configure the Blue/Green deployment settings to automatically terminate the original instances after a specified wait time.. Option A and Option C are correct. To automatically terminate old instances, the deployment group must be configured to re-use the original load balancer, and the original load balancer must be deregistered and then terminated after a specified wait time. Option B (registering instances to a new load balancer) is for green environment, not for termination. Option D (modifying the deployment group to not use load balancer) would break the deployment. Option E (changing deployment config to AllAtOnce) affects speed, not termination behavior.

Answer

Register the old instances to a new load balancer.

Answer

Change the deployment configuration to AllAtOnce.

Answer

Modify the deployment group to not use a load balancer.

Question 15

A company is using AWS CloudFormation to deploy a stack that includes an Amazon RDS Multi-AZ DB instance. The stack creation fails with the error 'The DB instance already exists'. The SysOps Administrator needs to resolve this issue without modifying the template. Which THREE steps should the administrator take? (Choose THREE.)

Accepted Answer

Update the CloudFormation stack to change the deletion policy of the DB instance to Retain.. Option A, Option C, and Option E are correct. Deleting the existing DB instance allows CloudFormation to create a new one. Changing the deletion policy to Retain (Option C) ensures the existing DB instance is not deleted if the stack is updated. Changing the DB instance identifier (Option E) avoids the name conflict. Option B (importing the resource) is not possible without modifying the template. Option D (using a different stack name) does not resolve the resource conflict.

Answer

Use the CloudFormation resource import feature to bring the existing DB instance into the stack.

Answer

Use a different stack name in the CloudFormation template.